New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack

Researchers discovered ENCFORGE, a new ransomware (malware that encrypts files and demands payment) written in Go, being deployed by JADEPUFFER attackers through a vulnerability in Langflow versions before 1.3.0. The attackers exploit CVE-2025-3248 (a flaw in the /api/v1/validate/code endpoint that allows unauthenticated code execution with a CVSS score of 9.8) to run malicious code that specifically targets AI infrastructure files like model weights, vector databases, and training datasets across the infected system.